JP2009065610A - Communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent computer virus infection from being expanded to a wireless LAN communication terminal when a computer virus generates on a wired-side communication network. <P>SOLUTION: A communication system includes a wireless LAN access point and a wireless LAN communication terminal. The wireless LAN access point stores therein a registration table in which a communication network identifier corresponds to each of access point identifiers, monitors a status of communication from a wired-side communication network to the wireless LAN communication terminal, sets an access point identifier and a communication network identifier different from the access point identifier being set at present from the registration table when it is determined that a virus generates, and transmits a notification signal containing the set access point identifier to the wireless LAN communication terminal. The wireless LAN communication terminal stores a profile table constituted of a plurality of profiles including access point identifiers, and sets the same access point identifier as the access point identifier contained in the notification signal from the profile table when the notification signal is received. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication system including a wireless LAN access point connected to a communication network and a wireless LAN communication terminal that communicates with the wireless LAN access point using a wireless LAN function.

In recent years, a communication network using a wireless LAN has been often constructed because of the advantage that a LAN connection can be made wirelessly. As shown in Non-Patent Document 1, normally, a communication network is rarely constructed only by a wireless LAN as in the ad hoc mode, and a wireless LAN communication terminal is wired via a wireless LAN access point as in the infrastructure mode. It is generally connected to a communication network such as the Internet. Normally, a wireless LAN access point serving as a wireless LAN base station transmits communication data from a wired communication network to a wireless LAN communication terminal, and transmits communication data from the wireless LAN communication terminal to a wired communication network. It had only a relay function.
Atmark IT (@IT) homepage URL http://www.atmarkit.co.jp/fpc/netdevice/003netdevice/wireless.htmlNetwork device textbook 3rd "Wireless LAN access point" to increase network flexibility Toshikazu Watanabe 2001/05/09

  However, as described above, since the conventional wireless LAN access point has only the relay function, even if a computer virus occurs in the wired communication network, the traffic is not blocked and the wireless LAN communication is performed as usual. The communication to the terminal was continued. As a result, there has been a problem in that the spread of computer viruses in wireless LAN communication terminals has been expanded and the maintenance of communication services has been hindered.

  The present invention has been made in view of the above-described problems. When a computer virus occurs in a wired communication network, the present invention prevents the spread of computer virus infection to wireless LAN communication terminals, and provides communication services. It aims at providing the communication system which can be provided continuously.

  The communication system according to the present invention designates at least one of the individual communication network identifiers associated with each of the plurality of communication networks and can communicate via the communication network corresponding to the designated communication network identifier. One wireless LAN access point, at least one wireless LAN communication terminal that can communicate with a wireless LAN access point that designates an access point identifier and designates the same access point identifier as the designated access point identifier by a wireless LAN function; The wireless LAN access point includes an identifier storage unit that stores the communication network identifier in association with each of a plurality of access point identifiers, and a communication that corresponds to the currently designated communication network identifier. A communication status monitoring unit for monitoring the communication status from the network to the wireless LAN communication terminal; A computer virus occurrence detection unit for detecting the occurrence of a computer virus based on the results; and an access point different from the currently designated access point identifier among the plurality of access point identifiers according to the detection of the occurrence of the computer virus An identifier setting unit that specifies an identifier and a communication network identifier corresponding to the identifier, and a transmission unit that transmits a notification signal including the specified access point identifier to the wireless LAN communication terminal. Includes a profile storage unit that stores a plurality of profiles including at least an access point identifier, a receiving unit that receives the notification signal, and a plurality of profiles that include the same access point identifier as the access point identifier included in the reception notification signal. Choose from Characterized in that it comprises a and a profile setting unit for designating the access point identifier with.

  According to the communication system of the present invention, the wireless LAN access point has an access point identifier different from the currently designated access point identifier out of a plurality of access point identifiers according to the occurrence of a computer virus, and communication corresponding thereto. Since the network identifier is designated, that is, the communication target is switched from the communication network in which the virus has occurred to the communication network in which the virus has not occurred, it is possible to prevent the spread of virus infection to the wireless LAN communication terminal.

  Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing a communication system 1 according to the present invention. The communication system 1 includes a wireless LAN access point 2, a wireless LAN communication terminal 3, communication networks 4-1 to 4-n, and voice call control devices 5-1 to 5-n (here n Is a positive integer).

  The wireless LAN access point 2 is connected to communication networks 4-1 to 4-n such as the Internet through a wired communication path. The communication networks 4-1, 4-2,..., 4-n are logically independent from each other at the level of the second layer (data link layer) of the OSI (Open Systems Interconnection) reference model. It is assumed that there is no route for automatic routing. The communication networks 4-1, 4-2,..., 4-n are connected to the voice call control devices 5-1, 5-2,. In addition, it is assumed that a server (not shown) necessary for implementing a voice service is connected to each of the communication networks 4-1, 4-2, ..., 4-n.

  The wireless LAN access point 2 and the wireless LAN communication terminal 3 can communicate with each other using the wireless LAN function. In the figure, only the wireless LAN access point 2 is shown as a wireless LAN access point, but a plurality of wireless LAN access points (not shown) having the same function may be included. . Further, in the figure, only the wireless LAN communication terminal 3 is shown as a wireless LAN communication terminal, but a plurality of wireless LAN communication terminals (not shown) having the same function are included. Also good.

  The wireless LAN access point 2 includes a wired transmission / reception unit 21, a wireless transmission / reception unit 22, a communication status monitoring unit 23, a computer virus occurrence detection unit 24, an identifier storage unit 25, and an identifier setting unit 26. .

  The wired transmission / reception unit 21 transmits / receives communication data to / from the communication networks 4-1 to 4-n. The wired transmission / reception unit 21 gives the communication data received from the communication networks 4-1 to 4-n to the wireless transmission / reception unit 22, and the communication data received from the wireless transmission / reception unit 22 is transmitted to the communication networks 4-1 to 4-n. Send to any of the. The wired transmission / reception unit 21 transmits / receives communication data only to / from a communication network (any one of the communication networks 4-1 to 4-n) corresponding to a communication network identifier set by an identifier setting unit 26 described later.

  The wireless transmission / reception unit 22 transmits / receives communication data to / from the wireless LAN communication terminal 3 using the wireless LAN function. The wireless LAN function may be realized by a normal method such as an infrastructure mode defined in IEEE 802.11. The wireless side transmission / reception unit 22 gives the communication data received from the wireless LAN communication terminal 3 to the wired side transmission / reception unit 21, and transmits the communication data received from the wired side transmission / reception unit 21 to the wireless LAN communication terminal 3. The wireless transmission / reception unit 22 communicates with the wireless LAN communication terminal 3 only when the access point identifier set by the identifier setting unit 26 (to be described later) and the access point identifier set by the wireless LAN communication terminal 3 are the same. Send and receive communication data between them. Further, the wireless-side transmitting / receiving unit 22 transmits a notification signal representing the set access point identifier to the wireless LAN communication terminal 3. For example, the wireless-side transmitting / receiving unit 22 intermittently transmits the set access point identifier to the wireless LAN communication terminal 3 by including it in a beacon signal.

  The communication status monitoring unit 23 includes a non-permitted port communication detection unit 231, an abnormal packet detection unit 232, a communication amount measurement unit 233, and a transmission source identification unit 234, and includes communication networks 4-1 to 4-n. Among them, the communication status from the communication network corresponding to the communication network identifier set by the identifier setting unit 26 described later is monitored to the wireless LAN communication terminal 3. The computer virus occurrence detection unit 24 detects the occurrence of a computer virus based on the monitoring result by the communication status monitoring unit 23.

  The non-permitted port communication detection unit 231 receives the port number set in the wired-side transmission / reception unit 21 in advance for communication with the communication networks 4-1 to 4-n, and the wired-side transmission / reception unit 21 actually receives communication. Monitors whether the port number matches. The computer virus occurrence detection unit 24 determines that unauthorized communication has been performed due to a virus when these two port numbers do not match. Usually, since a computer virus performs an access for the purpose of attack and propagation from an infected terminal to a specific port of another normal terminal, it is effective to monitor the port number that receives the communication.

  The abnormal packet detector 232 has a function of monitoring the normality of the packets that have arrived from the communication networks 4-1 to 4-n, and has a filter for detecting abnormal packets in advance. The abnormal packet detection unit 232 detects an abnormal packet from the characteristics obtained by detecting the virus itself included in the packet or analyzing the data included in the packet by the filter. The computer virus occurrence detection unit 24 determines that a virus has occurred when an abnormal packet is detected by the abnormal packet detection unit 232. Usually, a computer virus transmits an abnormal packet for exploiting a security defect from an infected terminal to another normal terminal. Therefore, a computer virus monitors packets arriving from the communication networks 4-1 to 4-n. The presence or absence of virus can be determined.

  The communication amount measuring unit 233 measures the amount of communication from the communication networks 4-1 to 4-n (such as the total data amount of packets arriving within a certain period). The computer virus occurrence detection unit 24 determines that a virus has occurred when an abnormality in the communication amount such as a sudden increase or decrease in the communication amount is recognized. Usually, since a computer virus intermittently performs communication different from normal from an infected terminal to another normal terminal, it is effective to monitor the traffic.

  The transmission source identification unit 234 identifies the transmission source (such as the IP address of the transmission source) based on the transmission source information (such as IP address information) included in the packets that have arrived from the communication networks 4-1 to 4-n. When the computer virus occurrence detection unit 24 stores, for example, the IP address of a legitimate source in advance and determines that the incoming packet is not a packet from the legitimate source based on this, It is determined that a virus has occurred.

  The identifier storage unit 25 stores a communication network identifier in a one-to-one correspondence with each of the plurality of access point identifiers. Different communication network identifiers are assigned to the communication networks 4-1 to 4-n. The communication network identifier in this embodiment is a VLAN-ID (Virtual Local Area Network Identifier). Also, the access point identifier in this embodiment is SSID (Service Set Identifier). FIG. 2 shows the SSID registration table. As shown in FIG. Each SSID and VLAN-ID are associated with each other on a one-to-one basis. For example, no. 1, SSID aa and VLAN-ID 1 are associated with each other, and other information as necessary is further associated with these. VLAN-ID 1, 2,..., N are identifiers assigned to the communication networks 4-1, 4-2,. The identifier shown in the figure is an example. For example, the SSID can normally be set within a range of up to 32 alphanumeric characters.

  The identifier setting unit 26 selects one of the plurality of SSIDs stored in the identifier storage unit 25, and sets the SSID and the VLAN-ID associated therewith. Usually, at the time of initial setting, the identifier setting unit 26 sets the No. in the SSID registration table shown in FIG. SSID aa and VLAN-ID 1 registered in 1 are set.

  Further, the identifier setting unit 26 is different from the already set SSID from among the plurality of SSIDs stored in the identifier storage unit 25 according to the determination of the occurrence of the computer virus by the computer virus occurrence detection unit 24. SSID is selected, and the SSID and the VLAN-ID associated therewith are set. For example, as shown in FIG. When the SSID aa and VLAN-ID 1 of 1 are set, the identifier setting unit 26 determines whether the computer virus is generated or not. 2 SSID bb is selected, bb is set as SSID, and 2 is set as VLAN-ID. As described above, the identifier setting unit 26 has a function of switching the setting of the SSID and the VLAN-ID according to the determination of the occurrence of the computer virus.

  For example, when the identifier setting unit 26 sets 2 as the VLAN-ID, the wired transmission / reception unit 21 transmits / receives communication data only to / from the communication network 4-2 corresponding to the VLAN-ID 2. Further, for example, when the identifier setting unit 26 sets bb as the SSID, the wireless-side transmission / reception unit 22 is connected to the wireless LAN communication terminal 3 only when the SSID set by the wireless LAN communication terminal 3 is also bb. Send and receive communication data.

  The wireless LAN communication terminal 3 includes a reception unit 31, a profile storage unit 32, a profile setting unit 33, and a transmission unit 34. The wireless LAN communication terminal 3 is, for example, a wireless LAN compatible telephone terminal or the like, and in this case, a call connection request is made to any one of voice call control devices 5-1 to 5 to n described later. Can do.

  The receiving unit 31 transmits / receives communication data to / from the wireless LAN access point 2 using the wireless LAN function. The receiving unit 31 receives communication data only from the wireless LAN access point in which the same SSID is set as the SSID set by the profile setting unit 33 described later. The receiving unit 31 receives the notification signal from the wireless LAN access point 2 and gives it to the profile setting unit 33. For example, the receiving unit 31 receives a beacon signal transmitted intermittently from the wireless LAN access point 2 and gives the profile setting unit 33 the SSID contained therein.

  The profile storage unit 32 stores a profile table including a plurality of profiles each including an access point identifier and other related information. FIG. 3 shows a profile table. “Profile No.” is a profile number, and is 1 to m (m is a positive integer) here. Each of the profiles 1 to m includes an SSID. For example, profile No. 1 includes an SSID aa, and an IP address 2100.9.110.10, SIP URI (SIP Uniform Resource Identifier) (phone number 03-111-) of a connection destination SIP (Session Initiation Protocol) server. 2222) and other information as necessary. Usually, some of the profiles 1 to m include the same SSID as any one of the plurality of SSIDs stored in the identifier storage unit 25 of the wireless LAN access point 2.

  The profile setting unit 33 selects one profile from the profile table stored in the profile storage unit 32 and sets the SSID included in the profile. Normally, at the time of initial setting, the profile setting unit 33 is set to No. in the profile table shown in FIG. SSID aa registered in 1 is set.

  Further, the profile setting unit 33 selects a profile including the SSID received from the receiving unit 31 from the profile table, and sets the SSID. For example, as shown in FIG. 1 is set, the profile setting unit 33 responds to the SSID bb received from the receiving unit 31 and includes No. 1 including this. 2 profile is selected and bb is set as the SSID. As described above, the profile setting unit 33 has a function of switching the setting of the SSID according to the SSID from the receiving unit 31.

  The transmission unit 34 has a function of transmitting communication data to the wireless LAN access point 2 using the wireless LAN function. The transmission unit 34 communicates with this only when the wireless LAN access point 2 sets the same SSID as the SSID set by the profile setting unit 33.

  FIG. 4 is a block diagram showing the voice call control device 5-1. The voice call control device 5-1 includes a call control unit 51, a transmission unit 52, and a reception unit 53. The call control unit 51 performs call control processing in response to a call connection request from the wireless LAN communication terminal 3. The transmission unit 52 transmits communication data to the communication network 4-1. The receiving unit 53 receives communication data from the communication network 4-1. Each of the voice call control devices 5-2 to 5-n has the same configuration as the voice call control device 5-1.

  FIG. 5 is a flowchart showing a connection processing routine in the wireless LAN communication terminal 3. The wireless LAN communication terminal 3 starts connection processing when it starts up or when the radio wave reception sensitivity reaches a predetermined intensity. First, the profile setting unit 33 sets the profile number from the profile table stored in the profile storage unit 32. 1 profile is selected, and SSID aa included in the profile is set (step S101). The transmission unit 34 tries to connect to the wireless LAN access point 2 with the setting of the SSID aa. If connection is possible (S102), the transmission unit 34 performs connection processing with the wireless LAN access point 2 (S107).

  When the transmission unit 34 cannot connect to the wireless LAN access point 2 by setting the SSID aa (S102), the profile setting unit 33 sets the profile No. from the profile table. 2 profile is selected, and SSID bb included in the profile is set (step S103). The transmission unit 34 tries to connect to the wireless LAN access point 2 with the setting of the SSID bb. If the connection is possible (S104), the transmission unit 34 performs a connection process with the wireless LAN access point 2 (S107).

  When the transmission unit 34 cannot connect to the wireless LAN access point 2 with the setting of the SSID bb (S102), the profile setting unit 33 sequentially sets the profile No. 1 in the same manner as described above. 3, 4,..., M are selected and the SSID included in the profile is set (S105), and the transmission unit 34 sequentially tries to connect to the wireless LAN access point 2 with the set SSID. (S106). When the transmission unit 34 cannot connect to the wireless LAN access point 2 by setting the SSID included in all these profiles, a display unit (not shown) included in the wireless LAN communication terminal 3 displays wireless LAN communication. A display indicating that the terminal 3 is out of the communication range with the wireless LAN access point 2 is displayed (S107), and the connection process is terminated.

  FIG. 6 is a flowchart showing an SSID switching processing routine in the wireless LAN access point 2. The SSID switching process will be described below with reference to FIG. Here, the identifier setting unit 26 is configured to display the No. of the SSID registration table stored in the identifier storage unit 25. It is assumed that SSID aa and VLAN-ID 1 registered in 1 are set in advance.

  The communication status monitoring unit 23 starts monitoring the communication status from the communication network 4-1 to the wireless LAN communication terminal 3 at an appropriate timing such as when the identifier setting unit 26 sets SSID aa and VLAN-ID 1. (Step S201).

  The non-permitted port communication detection unit 231 communicates with the port number set in the wired transmission / reception unit 21 in advance for communication with the communication network 4-1, and the wired transmission / reception unit 21 actually communicates from the communication network 4-1. It is monitored whether the received port number matches (S202). The abnormal packet detector 232 monitors the normality of the packet that has arrived from the communication network 4-1 (S203). The communication amount measuring unit 233 measures the communication amount from the communication network 4-1 (S204). The transmission source identifying unit 234 identifies the transmission source based on the transmission source information included in the packet that has arrived from the communication network 4-1 (S <b> 205).

  The computer virus occurrence detection unit 24 performs a statistical analysis process or the like on the monitoring result from the communication status monitoring unit 23, and determines whether or not a computer virus has occurred (S206). When the computer virus occurrence detection unit 24 determines that a computer virus has been generated (S207), the identifier setting unit 26 determines the number of the SSID registration table stored in the identifier storage unit 25 according to the determination result. 2 is selected, and SSID bb and VLAN-ID 2 associated therewith are set (S208). That is, the identifier setting unit 26 switches the SSID from aa to bb.

  The communication status monitoring unit 23 continues monitoring until an instruction to end monitoring is received from a control unit (not shown) or the like (S201). Here, since the identifier setting unit 26 sets VLAN-ID 2, the communication status monitoring unit 23 monitors the communication status from the communication network 4-2 to the wireless LAN communication terminal 3. When receiving the instruction to end the monitoring (S209), the communication status monitoring unit 23 ends the monitoring and ends the SSID switching process. By the SSID switching process, the wireless LAN access point 2 blocks communication with the communication network 4-1 in which the occurrence of virus has been detected, and starts communication with the communication network 4-2 in which no virus has been detected. Accordingly, it is possible to prevent the spread of virus infection to the wireless LAN communication terminal 3.

  FIG. 7 is a sequence diagram showing SSID transmission / reception and connection processing between the wireless LAN access point 2 and the wireless LAN communication terminal 3. Here, first, it is assumed that the wireless LAN communication terminal 3 is connected to the wireless LAN access point 2 by setting SSID aa.

  When the computer virus occurrence detection unit 24 determines that a computer virus has occurred based on the monitoring result by the communication status monitoring unit 23 (S301), the identifier setting unit 26 responds to the SSID bb according to the determination result. The attached VLAN-ID 2 is set (S302). The wireless transmission / reception unit 22 includes the SSID bb, which is the access point identifier after the setting is switched, in the beacon signal and transmits it to the wireless LAN communication terminal 3 (S303).

  The receiving unit 31 receives the beacon signal from the radio-side transmitting / receiving unit 22 and notifies the profile setting unit 33 of the SSID bb included therein. The profile setting unit 33 sequentially refers to the profiles stored in the profile storage unit 32, and profile No. including SSID bb. 2 is selected, and SSID bb is set instead of the currently set SSID aa (S304). That is, the profile setting unit 33 switches the SSID setting from aa to bb. The transmission unit 34 connects to the wireless LAN access point 2 using the newly set SSID bb (S305). Since both the wireless LAN access point 2 and the wireless LAN communication terminal 3 set the SSID bb, the wireless LAN access point 2 also switches the wireless LAN from the communication network 4-1 to the communication network 4-2. The access point 2 and the wireless LAN communication terminal 3 can communicate with each other.

  As described above, the wireless LAN access point in this embodiment stores in advance an SSID registration table in which SSIDs and VALN-IDs are associated with each other, and monitors the communication status from the wired communication network to the wireless LAN communication terminal. When it is determined that a virus has occurred based on the monitoring result, an SSID different from the currently set SSID is selected from the SSID registration table and associated with the SSID. Set VALN-ID (switch between SSID and VALN-ID). The wireless LAN access point includes the SSID after switching in the beacon signal and notifies the wireless LAN communication terminal of this.

  The wireless LAN communication terminal in the present embodiment stores in advance a profile table composed of a plurality of profiles each including an SSID, and when a beacon signal is received from a wireless LAN access point, it is included in the beacon signal from the profile table. The profile including the same SSID as the SSID to be selected is selected, and the SSID is set (SSID is switched).

  Thus, the wireless LAN access point switches the VALN-ID according to the occurrence of a virus, that is, switches the communication target from a communication network in which a virus has occurred to a communication network in which no virus has occurred. Can prevent the spread of virus infection. Further, the wireless LAN communication terminal can continue communication with the wireless LAN access point by setting the same SSID as the SSID notified from the wireless LAN access point. If the wireless LAN communication terminal is a telephone terminal, it will issue a call request to a voice call control device connected to a communication network in which no virus has occurred, and the call service will continue without being infected by the virus. Can receive.

1 is a block diagram illustrating a communication system according to the present invention. It is a figure showing an SSID registration table. It is a figure showing a profile table. It is a block diagram showing a voice call control apparatus. It is a flowchart showing the connection process routine in a wireless LAN communication terminal. It is a flowchart showing the SSID switching process routine in a wireless LAN access point. It is a sequence diagram showing SSID transmission / reception and connection processing between a wireless LAN access point and a wireless LAN communication terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Communication system 2 Wireless LAN access point 21 Wired side transmission / reception part 22 Wireless side transmission / reception part 23 Communication condition monitoring part 231 Unpermitted port communication detection part 232 Abnormal packet detection part 233 Communication amount measurement part 234 Originator identification part 24 Computer virus occurrence detection Unit 25 identifier storage unit 26 identifier setting unit 3 wireless LAN communication terminal 31 reception unit 32 profile storage unit 33 profile setting unit 34 transmission unit 4-1 to 4-n communication network 5-1 to 5-n voice call control device 51 call Control unit 52 Transmission unit 53 Reception unit

Claims (5)

At least one wireless LAN access point that designates one of the individual communication network identifiers associated with each of the plurality of communication networks and can communicate via the communication network corresponding to the designated communication network identifier;
A communication system that includes an access point identifier and a wireless LAN access point that is specifying the same access point identifier as the designated access point identifier and at least one wireless LAN communication terminal that can communicate with the wireless LAN function. ,
The wireless LAN access point is
An identifier storage unit that stores the communication network identifier in association with each of a plurality of access point identifiers;
A communication status monitoring unit that monitors the communication status from the communication network corresponding to the currently specified communication network identifier to the wireless LAN communication terminal;
A computer virus occurrence detection unit for detecting the occurrence of a computer virus based on the result of the monitoring;
An identifier setting unit for designating an access point identifier different from the currently designated access point identifier among the plurality of access point identifiers according to detection of occurrence of the computer virus, and a communication network identifier corresponding thereto;
A transmission unit for transmitting a notification signal including the designated access point identifier to the wireless LAN communication terminal,
The wireless LAN communication terminal is
A profile storage unit for storing a plurality of profiles each including at least an access point identifier;
A receiving unit for receiving the notification signal;
A profile setting unit for selecting a profile including the same access point identifier as the access point identifier included in the reception notification signal from the plurality of profiles and designating the access point identifier. system.   The communication status monitoring unit includes a match between a port number set in advance for communication with the communication network and a port number actually received, normality of a packet arriving from the communication network, the communication network 2. The communication system according to claim 1, wherein at least one of a communication amount from the packet and source information of the packet is monitored.   The communication system according to claim 1, wherein the access point identifier is an SSID (Service Set Identifier).   The communication system according to claim 1, wherein the communication network identifier is a VLAN-ID (Virtual Local Area Network Identifier).   The communication system according to claim 1, wherein the notification signal is a beacon.

Images